GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
Check your stack
GHSA-6439-2f28-8p8qhigh8.6

Symfony's HEAD Request Bypasses methods: ['GET'] Filter in #[IsGranted] / #[IsSignatureValid] / #[IsCsrfTokenValid]

Impact

Symfony's [IsGranted('...')], [IsSignatureValid], and [IsCsrfTokenValid(...)] attributes allow you to define a methods: [...] argument to only enforce these checks for the listed HTTP methods and skip them otherwise. E.g. an attribute defining methods: ['GET'] would be ignored for a HEAD request.

Source excerpt · OSV

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

symfony/http-kernel Packagist
Affected rangeRecorded fix
From 7.4.0 before 7.4.12Ecosystem versions7.4.12
From 8.0.0 before 8.0.12Ecosystem versions8.0.12

Version evidence: OSV · GHSA-6439-2f28-8p8q

View original version evidence (22 explicit versions)
symfony/security-http Packagist
Affected rangeRecorded fix
From 7.4.0 before 7.4.12Ecosystem versions7.4.12
From 8.0.0 before 8.0.12Ecosystem versions8.0.12

Version evidence: OSV · GHSA-6439-2f28-8p8q

View original version evidence (16 explicit versions)
symfony/symfony Packagist
Affected rangeRecorded fix
From 7.4.0 before 7.4.12Ecosystem versions7.4.12
From 8.0.0 before 8.0.12Ecosystem versions8.0.12

Version evidence: OSV · GHSA-6439-2f28-8p8q

View original version evidence (24 explicit versions)

Original source description

Description

Symfony's #[IsGranted('...')], #[IsSignatureValid], and #[IsCsrfTokenValid(...)] attributes allow you to define a methods: [...] argument to only enforce these checks for the listed HTTP methods and skip them otherwise. E.g. an attribute defining methods: ['GET'] would be ignored for a HEAD request.

On the other hand, Symfony's router (and HTTP semantics generally) serves HEAD requests using the GET handler. Therefore, a controller protected by e.g. #[IsGranted('ROLE_ADMIN', methods: ['GET'])] can be reached via HEAD with the authorization check silently skipped.

Even if the HEAD request won't get any response content, response headers leak (Content-Length, Location, custom headers). Also, the controller still executes and any side effects (DB writes, state changes) occur.

Resolution

When adding GET in the methods option of these attributes, Symfony now also include the HEAD method automatically.

The patch for this issue is available here for branch 7.4.

Credits

Symfony would like to thank Claude Mythos Preview (via Project Glasswing) for reporting the issue and Alexandre Daubois for fixing it.

References